Overview

overview

10

Static

static

0767556655...df.exe

windows7_x64

1

0767556655...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    07675566556 PURCHASE ORDERpdf.exe

  • Size

    876KB

  • Sample

    200321-mtmy6f89vn

  • MD5

    b274988968c4256575dd4c4403838324

  • SHA1

    a62d5ceb57ddec5dcffe768c6f48ff1dae66db67

  • SHA256

    bbf613ce1f6850b2b62c6f55082ab7b9bcc7f92db0a8ec8f0b495e29cb4988ae

  • SHA512

    abc5906d8e1e69ff1b33c61db06c4802e370efc8c15db8742092148fbb57aa8df3bd70e6b54fcf6b9a232642318510a4b352ce9810fbd7a1904b6f806d379978

Score
10/10
hawkeye_rebornkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      07675566556 PURCHASE ORDERpdf.exe

    • Size

      876KB

    • MD5

      b274988968c4256575dd4c4403838324

    • SHA1

      a62d5ceb57ddec5dcffe768c6f48ff1dae66db67

    • SHA256

      bbf613ce1f6850b2b62c6f55082ab7b9bcc7f92db0a8ec8f0b495e29cb4988ae

    • SHA512

      abc5906d8e1e69ff1b33c61db06c4802e370efc8c15db8742092148fbb57aa8df3bd70e6b54fcf6b9a232642318510a4b352ce9810fbd7a1904b6f806d379978

    Score
    10/10
    keyloggertrojanstealerspywarehawkeye_reborn

    • HawkEye Reborn

      HawkEye Reborn is an enchanced version of the HawkEye malware kit.

      keyloggertrojanstealerspywarehawkeye_reborn

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Uses the VBS compiler for execution

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks